CVE-2026-14182
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Customer Email Verification for WooCommerce WordPress plugin before version 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
Risk Assessment
An attacker can take over accounts of users who have not confirmed their email address, potentially leading to data theft, fraud, or unauthorized actions on their behalf.
Recommendation
Update the Customer Email Verification for WooCommerce plugin to version 3.2.6 or later, which includes the fix. Consider enforcing email verification for all accounts.
Other vulnerabilities in Customer Email Verification for WooCommerce
See all- CVE-2026-109236Medium
The Customer Email Verification for WooCommerce plugin in versions up to and including 2.8.2 is vulnerable to Authentication Bypass via a Predictable Email-Verification Token. The authenticate_user_by_email_link() function lacks capability and nonce checks, and the token is generated as md5(email . time()), allowing unauthenticated attackers to log in as a newly created customer or mark an account as verified.
- CVE-2026-104745High
The Customer Email Verification for WooCommerce plugin (versions up to and including 3.3.0) is vulnerable to privilege escalation via the 'alg_wc_ev_verify_email' parameter. The activation code is generated using wp_rand(100), yielding only ~101 possible values, and the verify() handler lacks nonce checks and rate limiting.
Original NVD description (English source)
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS